Add email magic link login#26
Merged
Merged
Conversation
Assisted-by: Claude Code:claude-opus-4-8 Assisted-by: Claude Code:claude-fable-5 Assisted-by: Codex:gpt-5-6-sol
Assisted-by: Claude Code:claude-opus-4-8 Assisted-by: Claude Code:claude-fable-5 Assisted-by: Codex:gpt-5-6-sol
Assisted-by: Claude Code:claude-opus-4-8 Assisted-by: Claude Code:claude-fable-5 Assisted-by: Codex:gpt-5-6-sol
sij411
reviewed
Jul 20, 2026
sij411
reviewed
Jul 20, 2026
sij411
left a comment
sij411
left a comment
Member
There was a problem hiding this comment.
Since it's 6 char code, adding rate-limiting might be good?
sij411
reviewed
Jul 20, 2026
Member
Author
Many sites use 4 to 6 characters (based on my experience). |
This was referenced Jul 21, 2026
Co-authored-by: Hong Minhee <hong@minhee.org>
dodok8
requested changes
Jul 22, 2026
dodok8
left a comment
dodok8
left a comment
Member
There was a problem hiding this comment.
I tried to integrate with solid-relay to get some work done, but there’s no command to actually create the schema SDL file, so I can’t integrate it. If a query has been created, I hope this PR will include a command to generate the SDL file from the query.
Member
|
@dodok8 Okay, but we will work on it from a separate pull request! |
Co-authored-by: Hong Minhee <hong@minhee.org>
Co-authored-by: Hong Minhee <hong@minhee.org>
Co-authored-by: Hong Minhee <hong@minhee.org>
dahlia
approved these changes
Jul 22, 2026
dahlia
enabled auto-merge
July 22, 2026 07:23
dodok8
approved these changes
Jul 22, 2026
github-project-automation
Bot
moved this from In progress
to Done
in NLnet NGI0 Commons Fund (2026)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #23. A user requests a login link by email.
Model
login_tokens:accountId,tokenHash(unique, lookup key),codeHash,created,expires(default 15 minutes),consumed.sessions:accountId,tokenHash(unique),created,expires(default 1 month).GraphQL API
loginByEmail(email: Email!, verifyUrl: String): SendMail— emails a login token/code;verifyUrl. Always returnstokento prevent account enumeration — deviates from the proposedLoginSuccess | AccountNotFoundErrorunion for the same reason.completeLoginChallenge(token: UUID!, code: String!): Session—nullon a bad/expired/consumed token or wrong code;accessTokenexposed only here.revokeSession(session: UUID!): LogoutSuccess— alwaysrevoke: true.viewer: Account— the authenticated account, ornull.Implementation
login_tokensandsessionswith migrationemail_auth; secrets stored as SHA-256 digests only, constant-time code comparison.@upyo/core/smtp/mock); falls back toMockTransportwith a warning when no mailer is configured.--smtp-url/-sand--seedoptions.auth.test.tscovers the full flow end to end against PGlite.Out of scope (per issue): frontend/BFF, sign-up, PassKey, rate limiting, UI.
AI Disclosure
Developed with AI agents from Claude Code (claude-opus-4-8, claude-fable-5) and Codex (gpt-5-6-sol), per
AI_POLICY.md; commits carryAssisted-by:trailers. All AI-assisted code was manually reviewed and verified locally. I requested questions, reviews, translations, etc. from the AI agent, and prohibited it from directly writing or modifying source code. Code modifications were made directly by a human.